@highflame/policy 2.2.45 → 2.4.0

package/_schemas/agent_ops/schema.cedarschema

@@ -118,6 +118,18 @@ namespace AgentOps {
         context: ProvisionSandboxContext
     };
 
+    /// The acting agent's lifecycle and IdP provenance, projected as
+    /// `context.actor`. Same four attributes, names and types as the legacy
+    /// members on PrincipalContext (which keeps them). Every member is optional
+    /// and the record is absent when none is supplied; absence means unknown,
+    /// not "active".
+    type ActorContext = {
+        "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"
+        "origin"?: String,             // "native" | "entra" | "okta" | ...
+        "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+        "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
+    };
+
     // =========================================================================
     // Context Types (Action-Specific)
     // =========================================================================
@@ -158,6 +170,10 @@ namespace AgentOps {
         "act_iss"?: String,            // Issuer of the actor claim
         "mission_id"?: String,         // Correlates one delegation tree
         "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+        "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"; absent = unknown, not active
+        "origin"?: String,             // Where the identity came from: "native" | "entra" | "okta" | ...
+        "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+        "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
     };
 
     /// Context for the process_response action.
@@ -175,6 +191,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service" | "mcp_server"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -370,6 +387,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -581,6 +599,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -689,6 +708,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -801,6 +821,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -934,6 +955,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service" | "mcp_server"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         "agent_trust_level"?: String,    // "untrusted" | "low" | "verified" | "trusted"
 
         // Core metadata (required)

package/_schemas/ai_gateway/schema.cedarschema

@@ -83,6 +83,8 @@ action call_tool appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     // --- Content ---
     content: String,                  // Raw content being scanned
 
@@ -205,6 +207,8 @@ action connect_server appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     content?: String,                 // Server config content (if available)
     mcp_server?: String,
 
@@ -302,6 +306,8 @@ action list appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
 
     // --- Content ---
     // The enumerated item's description. Optional: a tool may declare none,
@@ -376,6 +382,43 @@ action list appliesTo {
   },
 };
 
+// ZeroID NHI principal block, projected by Shield as `context.principal` when
+// the caller's token carries NHI claims. Same shape as the Guardrails and
+// AgentOps PrincipalContext, so one policy text reads the same keys on every
+// product. Every member is optional except `delegation_depth` (always emitted;
+// 0 for a direct token). The record is absent, not empty, when the request
+// carries no NHI claims, so `context has principal` is false.
+type PrincipalContext = {
+  "identity_type"?: String,      // "human" | "agent" | "service" | "mcp_server"
+  "sub_type"?: String,           // Identity subtype (e.g. "coding_agent")
+  "trust_level"?: String,        // "first_party" | "verified" | "unverified"
+  "framework"?: String,          // Agent framework (e.g. "langchain")
+  "publisher"?: String,          // Agent publisher
+  "capabilities"?: Set<String>,  // Capabilities granted to the identity
+  "scopes"?: Set<String>,        // OAuth scopes carried by the token
+  "delegation_depth": Long,      // Delegation hops; 0 for a direct token
+  "act_sub"?: String,            // RFC 8693 actor: the accountable human
+  "act_iss"?: String,            // Issuer of the actor claim
+  "mission_id"?: String,         // Correlates one delegation tree
+  "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+  "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"; absent = unknown, not active
+  "origin"?: String,             // Where the identity came from: "native" | "entra" | "okta" | ...
+  "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+  "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
+};
+
+// The acting agent's lifecycle and IdP provenance, projected as
+// `context.actor`. Firehog traffic is evaluated in this namespace, which is
+// where agents registered in Okta or Entra reach Shield (ADR 0041 D5,
+// ADR 0042). Every member is optional and the record is absent when none is
+// supplied; absence means unknown, not "active".
+type ActorContext = {
+  "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"
+  "origin"?: String,             // "native" | "entra" | "okta" | ...
+  "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+  "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
+};
+
 // Shared content-inspection context.
 //
 // Prompts and responses are inspected by the same detector pipeline and so
@@ -386,6 +429,8 @@ type ContentInspectionContext = {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     content: String,
     mcp_server?: String,
 
@@ -497,6 +542,8 @@ action read_file appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     content: String,
     mcp_server?: String,
 
@@ -564,6 +611,8 @@ action write_file appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     content: String,
     mcp_server?: String,
 

package/_schemas/ai_gateway/templates/single_use_sensitive_tools.cedar

@@ -0,0 +1,54 @@
+// =============================================================================
+// Single-Use for Sensitive Tools
+// =============================================================================
+// Permits sensitive tool calls, but only once per grant. @single_use makes
+// Shield record the first allow in an atomic consume store and deny any replay
+// of the same grant ("grant_consumed"). Bare @single_use means per tool: one
+// allow covers any call to the same action and tool. Use
+// @single_use("request") instead to bind the allow to one exact set of
+// arguments.
+//
+// @single_use is only valid on a permit. Deny, DEFER and step-up outcomes
+// never consume. If the consume store is unavailable the request is denied
+// ("single_use_store_unavailable") unless the operator opted into fail-open.
+//
+// Requests that carry no bearer token, such as gateway and internal-service
+// traffic, have no token id to record the use against. Shield denies every
+// sensitive call_tool from them ("single_use_unbound"), whatever the
+// fail-open setting. Until the gateway forwards the caller's token to Shield
+// (ADR 0041 D16, ADR 0042 D10), that means every sensitive gateway call.
+//
+// Try it with request-level monitor mode (guard requests sent with
+// mode=monitor): single_use.would_deny on each response shows what enforcing
+// would deny. Per-policy monitor mode does NOT exercise @single_use, because
+// Shield reads it only from enforcing policies; a monitor-mode copy of this
+// template reports nothing, and switching it to enforce takes effect at once.
+//
+// Adopted alone, this permit also allows every sensitive call_tool (once per
+// grant). Pair it with the policies that decide which sensitive calls are
+// allowed at all.
+//
+// Context keys consumed:
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP ASI02
+//
+// Category:  agent-identity
+// Namespace: AIGateway
+// =============================================================================
+
+@id("agent-identity.permit-single-use-sensitive-tools")
+@name("Permit sensitive tools once per grant")
+@description("Permits call_tool on a sensitive tool once per grant.")
+@severity("medium")
+@tags("category:agent-identity,surface:call-tool,scope:per-tool,owasp:asi02,single-use")
+@single_use
+permit (
+    principal,
+    action == AIGateway::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_is_sensitive && context.tool_is_sensitive
+};

package/_schemas/ai_gateway/templates/templates.json

@@ -33,6 +33,12 @@
       "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls.",
       "layer": "guardrail"
     },
+    {
+      "id": "agent-identity",
+      "name": "Agent Identity",
+      "description": "Agent lifecycle and provenance controls for gateway traffic: unadopted agents, single-use sensitive tools.",
+      "layer": "guardrail"
+    },
     {
       "id": "organization",
       "name": "Organization",
@@ -197,6 +203,37 @@
         "compliance:pci-dss",
         "compliance:hipaa"
       ]
+    },
+    {
+      "id": "agent-identity.block-unadopted-agent-sensitive-tools",
+      "name": "Unadopted Agents: No Sensitive Tool Calls",
+      "description": "Block sensitive tool calls from agents whose lifecycle status is not active (discovered or pending). Deploy in monitor mode first to see which discovered agents already call sensitive tools.",
+      "category": "agent-identity",
+      "file": "unadopted_agents.cedar",
+      "severity": "high",
+      "tags": [
+        "category:agent-identity",
+        "detection:rule",
+        "surface:call-tool",
+        "scope:per-agent",
+        "posture:deny-default",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "agent-identity.permit-single-use-sensitive-tools",
+      "name": "Single-Use for Sensitive Tools",
+      "description": "Permit sensitive tool calls once per grant: the first allow is recorded and a replay of the same grant is denied. Bare @single_use means per tool; use @single_use(\"request\") to bind to one set of arguments. Requests without a bearer token (gateway and internal-service traffic, until the gateway forwards the caller token) are denied (single_use_unbound). Try it with request-level mode=monitor: per-policy monitor mode does not exercise @single_use. Adopted alone, it also permits every sensitive call.",
+      "category": "agent-identity",
+      "file": "single_use_sensitive_tools.cedar",
+      "severity": "medium",
+      "tags": [
+        "category:agent-identity",
+        "surface:call-tool",
+        "scope:per-tool",
+        "owasp:asi02",
+        "single-use"
+      ]
     }
   ]
 }

package/_schemas/ai_gateway/templates/unadopted_agents.cedar

@@ -0,0 +1,64 @@
+// =============================================================================
+// Unadopted Agents: No Sensitive Tool Calls
+// =============================================================================
+// Agents that an enterprise registers in its own IdP (Entra Agent ID, Okta AI
+// agents) are discovered by Highflame before anyone adopts them. A discovered
+// or pending agent has an identity but no owner-reviewed policy, so it should
+// not reach sensitive tools until it is adopted (status "active").
+//
+// `context.actor.status` carries the agent lifecycle status. When no actor
+// record is present the rule falls back to the legacy `context.principal.status`
+// profile. Absence means "unknown", not "active": the has-guards below make a
+// request with no status fall through to the other rules instead of being
+// matched here. Any status other than "active" is matched, so suspended and
+// deactivated agents are blocked too. The comparison is case-sensitive, like
+// ZeroID's lowercase status values.
+//
+// Today this template is forward-looking. ZeroID mints tokens only for active
+// identities and stamps "active" at mint, and every caller of Shield forwards
+// that value, so no live path reports another status yet. It takes effect when
+// a non-active status reaches Shield, as ADR 0042 plans for agents registered
+// in a customer IdP. The status is a mint-time snapshot: an identity suspended
+// after its token was minted reads "active" until the token expires.
+//
+// `tool_is_sensitive` is set by Shield's tool_validator from a fixed list of
+// tool names (shell, execute_command, write_file, http_post, send_email,
+// delete_file, run_sql, plus Shield's configured list); other tools are not
+// sensitive and are not matched.
+//
+// This copy covers gateway traffic (Firehog), which Shield evaluates in the
+// AIGateway namespace. The Guardrails copy covers Guardrails traffic.
+//
+// Deploy in MONITOR mode first to see which discovered agents already call
+// sensitive tools, adopt them, then switch to enforce.
+//
+// Context keys consumed:
+//   - actor, principal: records - status is the agent lifecycle status
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP ASI04
+//
+// Category:  agent-identity
+// Namespace: AIGateway
+// =============================================================================
+
+@id("agent-identity.block-unadopted-agent-sensitive-tools")
+@name("Block unadopted agents from sensitive tools")
+@description("Blocks call_tool on a sensitive tool when actor.status (or, without an actor record, principal.status) is present and is not active.")
+@severity("high")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi04")
+@reject_message("Tool execution blocked: this agent has not been adopted, so it may not call sensitive tools. Adopt the agent to activate it.")
+forbid (
+    principal,
+    action == AIGateway::Action::"call_tool",
+    resource
+)
+when {
+    (
+        (context has actor && context.actor has status && context.actor.status != "active") ||
+        (!(context has actor) && context has principal && context.principal has status &&
+         context.principal.status != "active")
+    ) &&
+    context has tool_is_sensitive && context.tool_is_sensitive
+};

package/_schemas/guardrails/schema.cedarschema

@@ -141,6 +141,22 @@ namespace Guardrails {
         "act_iss"?: String,            // Issuer of the actor claim
         "mission_id"?: String,         // Correlates one delegation tree
         "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+        "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"; absent = unknown, not active
+        "origin"?: String,             // Where the identity came from: "native" | "entra" | "okta" | ...
+        "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+        "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
+    };
+
+    /// The acting agent's lifecycle and IdP provenance, projected as
+    /// `context.actor`. Same four attributes, names and types as the legacy
+    /// members on PrincipalContext (which keeps them). Every member is optional
+    /// and the record is absent when none is supplied; absence means unknown,
+    /// not "active".
+    type ActorContext = {
+        "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"
+        "origin"?: String,             // "native" | "entra" | "okta" | ...
+        "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+        "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
     };
 
     /// Context for the process_response action.
@@ -160,6 +176,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -312,6 +329,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -508,6 +526,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -581,6 +600,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -658,6 +678,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,

package/_schemas/guardrails/templates/dual_attribution.cedar

@@ -1,22 +1,77 @@
 // =============================================================================
 // Dual Attribution
 // =============================================================================
-// Blocks privileged agent actions that cannot be attributed to a human. "Which
-// agent did this?" is half an answer; the other half is "on whose behalf?" An
-// agent is not an accountable party — the person who pointed it at the work
-// is. Shield projects both sides of that pair, so the requirement can be a
-// policy rather than a reporting convention nobody enforces.
+// Routes privileged agent actions that no human answers for to explicit
+// human approval. "Which agent did this?" is half an answer; the other half
+// is "on whose behalf?" When an agent acts for a person, that person is the
+// accountable party. When it acts for nobody (an autonomous agent, a
+// workload, an api_key-rooted token), its sensitive tool calls run only when
+// someone explicitly authorizes them, never silently and never by default.
 //
 // The agent comes from the authenticated identity, never from the request
 // body: agent_id, agent_type, agent_trust_level, agent_framework. The human
-// comes from the identity claims on the credential, as the `principal` record
-// — its `act_sub` field names the party the agent is acting for.
+// comes from the identity claims on the credential, as the `principal`
+// record. Its `act_sub` field names the human the agent acts for, and is
+// absent when there is none: legacy tokens carry the delegating parent (or
+// the api key's creator), while rfc8693 tokens carry it only when the
+// delegation chain is rooted in a user. Autonomous, workload and
+// api_key-rooted rfc8693 tokens have no act_sub.
 //
-// Deploy in MONITOR mode first. Section 2 blocks unverified agents, and a
-// service key authenticates as unverified until the agent is registered and
-// adopted in Studio. Monitor records what each rule would have blocked on
-// every event without blocking anything; register the agent, then switch to
-// enforce.
+// How an agent call with no acting human is authorized: it needs an
+// explicit approval OR an explicit grant.
+//   1. Approval. Section 1 permits the call but suspends it for step-up
+//      approval (@step_up_required, AARM R4, CAP-ENF-004): Shield issues an
+//      OpenID CIBA challenge and the call runs only after an approver with
+//      the named AuthN role approves it; the timeout denies it (fail-closed).
+//   2. Grants. Allow/deny rows in Studio's agent access table compile to
+//      permits (grants) and forbids (restrictions) that Shield evaluates per
+//      agent. A restriction always denies. Section 1 carries
+//      @step_up_unless_granted, so when an allow grant explicitly matches
+//      the call under an ENFORCING access posture, Shield waives the
+//      challenge and the call runs (recorded as step_up_waived_by_grant).
+//      Under the default shadow posture a grant is only observed, so it
+//      waives nothing and approval decides. With no matching grant the call
+//      is challenged under either posture, not denied for lack of a grant.
+//   The waiver needs every step-up policy matching the call to carry
+//   @step_up_unless_granted: another step-up policy without it still
+//   challenges. Shield releases older than the grant waiver ignore the
+//   annotation: there a no-human call needs the approval even when granted,
+//   and under an enforcing posture an ungranted one is denied outright.
+//
+// A call carrying an acting human (act_sub present) is untouched by
+// Section 1, unless the agent is autonomous and not first_party.
+//
+// Customize Section 1 before deploying:
+//   - @step_up_unless_granted: remove it to require the approval even for
+//     calls an allow grant covers (grant AND approval).
+//   - role: must exist in authn.roles ("security_oncall" is a placeholder;
+//     unknown roles reject the policy at deploy time). Another step-up
+//     policy matching the same call must name the same role, or Shield
+//     denies the call (one approval cannot satisfy two roles).
+//   - timeout_seconds: this template sets 3600 (1h); when omitted the
+//     default is 86400 (24h). Bounds [60, 604800].
+//
+// Deploy this policy in ENFORCE mode. Section 1's approval gate exists only
+// in enforce mode: in monitor or alert mode Shield issues no challenge and
+// passes Section 1's Allow through unchanged. Section 1 is a permit, so in
+// a policy set without the baseline permit (organization.permit-baseline)
+// it is what lifts the implicit deny for these calls. In enforce mode that
+// lift is gated on approval (or a grant); in monitor mode the same calls
+// would be allowed with no approval at all, a widening, not an observation.
+//
+// Only Section 2 is safe to observe first. It blocks unverified agents, and
+// a service key authenticates as unverified until the agent is registered
+// and adopted in Studio. Either register and adopt the agents before
+// deploying, or move Section 2 into its own policy, deploy that one in
+// MONITOR mode to see what it would block, and switch it to enforce once
+// the agents are adopted. Mode is per policy, so never put this whole
+// template in monitor to trial Section 2.
+//
+// Change note: Section 3 (autonomous agents must be first_party) used to be
+// a hard block. It is now folded into Section 1, so a non-first-party
+// autonomous agent's sensitive call is routed to approval (or a grant)
+// instead of being denied. To restore the hard block, add the forbid kept
+// in the Section 3 comment below; it overrides approvals and grants.
 //
 // Detection layers:
 //   - agent identity (authentication layer, always available)
@@ -24,7 +79,8 @@
 //
 // Context keys consumed:
 //   - agent_id, agent_type, agent_trust_level: String
-//   - principal: record — act_sub names the accountable human
+//   - principal: record; act_sub names the acting human, absent when the
+//     agent acts for nobody
 //   - tool_is_sensitive: Bool
 //   - tool_category: String
 //
@@ -36,33 +92,69 @@
 // =============================================================================
 
 // ---------------------------------------------------------------------------
-// Section 1: No unattributed privileged action
-// `unless` because the rule must fire when attribution is ABSENT, and an
-// absent field cannot be compared — only tested for.
+// Section 1: No-human privileged action requires approval
+// ENFORCE mode only: in monitor mode this permit allows the call with no
+// approval (see the header).
+// Matches when attribution is ABSENT (an absent field cannot be compared,
+// only tested for), and also for autonomous agents that are not first_party
+// even when a human is attached: nobody watches an autonomous agent in real
+// time, and a legacy api_key token names the key's creator as act_sub
+// whether or not that person is directing the call.
+//
+// Cedar is deny-overrides and Shield issues step-up only when the decision
+// is Allow, so this permit must not coexist with a forbid on the same calls:
+// the forbid would deny every one of them and no approval would be asked.
+// To hard-block instead of gating on approval, replace this rule with:
+//
+//   @id("agent-identity.require-principal-for-sensitive-tools")
+//   @name("Block sensitive agent tools without a principal")
+//   @description("Blocks call_tool on a sensitive tool by an agent unless the credential carries a principal whose act_sub names the human the agent acts for.")
+//   @severity("critical")
+//   @tags("category:agent-identity,detection:rule,scope:per-agent,surface:call-tool,owasp:asi01,posture:deny-default")
+//   @reject_message("Tool execution blocked: this agent invoked a sensitive tool with no accountable human attached.")
+//   forbid (
+//       principal,
+//       action == Guardrails::Action::"call_tool",
+//       resource
+//   )
+//   when {
+//       context has agent_id && context.agent_id != "" &&
+//       context has tool_is_sensitive && context.tool_is_sensitive == true
+//   }
+//   unless {
+//       context has principal && context.principal has act_sub
+//   };
 // ---------------------------------------------------------------------------
 
-@id("agent-identity.require-principal-for-sensitive-tools")
-@name("Block sensitive agent tools without a principal")
-@description("Blocks call_tool on a sensitive tool by an agent unless the credential carries a principal whose act_sub names the human the agent acts for.")
+@id("agent-identity.step-up-sensitive-tools-without-principal")
+@name("Permit no-human sensitive agent tools with step-up approval")
+@description("Permits call_tool on a sensitive tool by an agent with no acting human (no act_sub), or an autonomous agent that is not first_party, but suspends it until an approver with the configured AuthN role approves, unless an enforcing allow grant explicitly covers the call.")
 @severity("critical")
-@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi01")
-@reject_message("Tool execution blocked: this agent invoked a sensitive tool with no accountable human attached. Every privileged agent action must name the person it acts for.")
-forbid (
+@tags("category:agent-identity,detection:rule,scope:per-agent,surface:call-tool,posture:deny-default,owasp:asi01,step-up")
+@step_up_required("role=security_oncall,timeout_seconds=3600")
+@step_up_unless_granted
+permit (
     principal,
     action == Guardrails::Action::"call_tool",
     resource
 )
 when {
     context has agent_id && context.agent_id != "" &&
-    context has tool_is_sensitive && context.tool_is_sensitive == true
-}
-unless {
-    context has principal && context.principal has act_sub
+    context has tool_is_sensitive && context.tool_is_sensitive == true &&
+    (
+        !(context has principal && context.principal has act_sub) ||
+        (
+            context has agent_type && context.agent_type == "autonomous" &&
+            !(context has agent_trust_level && context.agent_trust_level == "first_party")
+        )
+    )
 };
 
 // ---------------------------------------------------------------------------
 // Section 2: Trust level gates the blast radius
 // Start in monitor: a service key is unverified until the agent is adopted.
+// Unverified agents are blocked outright, approval or not: registration and
+// adoption come before any per-call authorization.
 // ---------------------------------------------------------------------------
 
 @id("agent-identity.block-unverified-agent-sensitive-tools")
@@ -85,26 +177,29 @@ when {
 };
 
 // ---------------------------------------------------------------------------
-// Section 3: Autonomous agents get a higher bar
-// Nobody watches an autonomous agent in real time, so a sensitive tool call
-// from one requires first-party trust rather than merely "not unverified".
+// Section 3 (folded into Section 1): autonomous agents need first-party trust
+// This template used to forbid sensitive tool calls from autonomous agents
+// that are not first-party. A forbid would deny the very calls Section 1
+// routes to approval, so the condition now lives in Section 1 and those
+// calls require approval instead of being blocked. To hard-block them anyway
+// (overriding approvals and grants), add:
+//
+//   @id("agent-identity.restrict-autonomous-agent-sensitive-tools")
+//   @name("Block non-first-party autonomous agent tool use")
+//   @description("Blocks call_tool on a sensitive tool when agent_type is autonomous unless agent_trust_level is first_party.")
+//   @severity("high")
+//   @tags("category:agent-identity,threat:escalation,detection:rule,surface:call-tool,scope:per-agent,owasp:asi04")
+//   @reject_message("Tool execution blocked: autonomous agents must be first-party to call sensitive tools.")
+//   forbid (
+//       principal,
+//       action == Guardrails::Action::"call_tool",
+//       resource
+//   )
+//   when {
+//       context has agent_type && context.agent_type == "autonomous" &&
+//       context has tool_is_sensitive && context.tool_is_sensitive == true
+//   }
+//   unless {
+//       context has agent_trust_level && context.agent_trust_level == "first_party"
+//   };
 // ---------------------------------------------------------------------------
-
-@id("agent-identity.restrict-autonomous-agent-sensitive-tools")
-@name("Block non-first-party autonomous agent tool use")
-@description("Blocks call_tool on a sensitive tool when agent_type is autonomous unless agent_trust_level is first_party.")
-@severity("high")
-@tags("category:agent-identity,threat:escalation,detection:rule,surface:call-tool,scope:per-agent,owasp:asi04")
-@reject_message("Tool execution blocked: autonomous agents must be first-party to call sensitive tools. No human is in the loop to catch a mistake.")
-forbid (
-    principal,
-    action == Guardrails::Action::"call_tool",
-    resource
-)
-when {
-    context has agent_type && context.agent_type == "autonomous" &&
-    context has tool_is_sensitive && context.tool_is_sensitive == true
-}
-unless {
-    context has agent_trust_level && context.agent_trust_level == "first_party"
-};